Abstract

In heterogeneous robot swarms, caste reassignment is a high-frequency runtime event: battery depletion forces a logistics-caste robot into a low-power patrol caste; a payload limit forces a heavy-lift caste robot into an observation caste. Existing approaches treat reassignment as an internal allocation algorithm (auction, consensus bundle, behaviour-tree) and do not expose the reassignment event to external authority. We argue that for regulated embodied deployments a caste change that elevates a robots privilege envelope is a governance event that must be auditable and externally authorised. We propose an asymmetric-trust protocol in which auto-tightening reassignments (going to safer or lower-privilege castes) are admitted automatically while bounded relaxation (going to higherprivilege castes) requires operator countersignature. The protocol carries a signed cause-chain documenting why each reassignment was needed; the chain is a hashchained, Merkle-committed audit log verifiable offline against the operators key. We evaluate a reference implementation with real Ed25519 signatures and a hash-chained Merkle audit log, in simulation over fleets up to 100 robots with a parameterized robot-class timing point at 10 robots (slower signatures, heavier wireless variance; not a hardware measurement): auto-tightening completes in single-digit to low-double-digit milliseconds and the audit gate adds single-digit to low-double-digit milliseconds over an ungoverned reassignment (growing with fleet size). The protocol refuses all four explicit attack patterns (caste laundering, repeated-relaxation privilege escalation, operator impersonation, and cause-chain forgery) by construction; a partially-governed baseline isolates which gate stops which attack, a real offline auditor reconstructs and verifies every record and rejects tampering, and forged tighten records never reach the Byzantine quorum. The construction generalises a single-agent persona-mutation governance gate to swarm-level caste governance.